The present invention relates to a modular system of safety switching devices, i.e. a modular safety switching device system, for switching on and fail-safely switching off actuators. The system comprises at least one input module for fail-safely evaluating a safety transmitter and for generating an output signal, and at least one output module for fail-safely actuating the actuator in response to the output signal from the input module. At least the input module can be operated in different operating modes.
Safety switching devices are generally known. They are generally used to evaluate a signal from a safety transmitter, such as an emergency off switch, a protective door position switch, etc. in a fail-safe manner and to drive one or more fail-safe output contacts of an output circuit. Actuators, such as contactors, valves, motors, hazardous machine parts, for example saw blades, robot arms, high-voltage equipment, etc. are brought into a safe state via these output contacts then. The present assignee distributes a large number of different safety switching device types under the common trade name xe2x80x9cPNOZxe2x80x9d.
In practice, it often occurs that a plurality of switching events, for example the actuation of an emergency off switch, the opening of a protective door, or reaching through a light curtain, have to be interconnected, for example AND-linked. For this purpose, a plurality of switching devices are usually connected in series, the output terminals of one safety switching device being connected to the input terminals of the following safety switching device.
In many cases, in addition to the AND linking, a hierarchical structure of the safety switching devices is desired, in order, for example, to stop the entire machine with one switching event, for example the emergency off switch in one case, and, with other switching events, for example a protective door switch, to stop only a specific motor in the entire machine or to keep it stationary. Such a hierarchical structure has hitherto been possible by appropriate wiring and it has proved successful in practice.
Nevertheless, there remains a desire to provide a structure of safety switching devices which is more flexible, so that machine-specific evaluation of safety switching events becomes easily possible without complicated wiring.
Accordingly, it is an object of the present invention to provide a modular safety switching device system which permits flexible linking of the safety switching devices used, without having to perform complicated wiring for linking the individual safety switching devices and in particular without specific wiring for different operating modes of the input modules.
According to one aspect of the invention, this object is achieved by a the modular safety switching device system as mentioned at the outset having a control module for setting the operating mode of the input and output modules, and having a display for fail-safely displaying the set operating modes of the input modules and/or of the output modules.
In the new safety switching device system, therefore, the operating mode of each input and output module can be specifically set via the control module and checked via the display. In the case of the input modules, xe2x80x9coperating modexe2x80x9d might include, for example, which output module the input modules are assigned to, i.e. to which output module the output signal from the input module is fed. Further operating modes of the input modules might be, for example: start-up test, acknowledgment, deactive, etc. Operating modes in the case of the output modules are, for example, different delay times for switching off the outputs with a delay, for example 0 seconds, 0.5 seconds or 1 second. The term xe2x80x9cfail-safexe2x80x9d is to be understood to mean that the function of the display is checked, so that a faulty display of the operating mode can be ruled out.
The advantage of this modular safety switching device system is a simple and very flexible setting and configuration. In particular, different systems can be achieved with the same modular structure, by changing the assignment of input modules to output modules. Furthermore, hierarchical systems can also be built up, in which for example one input module acts on two output modules and other input modules act on one output module each. These settings and changes can be made without changing the wiring, which not only saves costs in the maintenance and setting up of such a system but also eliminates sources of error which can arise from erroneous wiring.
Overall, therefore, a safety switching device system can be built up which can be configured very flexibly and simply to an extremely wide range of requirements, the configuration being carried out via a central control module. In particular, the output signals from the input modules can be fed to the output modules in any desired manner. In this case, the programs for all the selectable operating modes are stored completely in the control module and are checked and approved by a certification authority, for example the professional association. By means of the configuration, the desired operating modes, preferably the desired programs, are selected and the application-specific program of the safety system is assembled from the standard programs stored in the control module. The advantage is that the checking of application-specific software is not necessary.
A further advantage of the inventive safety switching device system not only resides in the fact that the user can rely on the respective display of the operating mode when setting up the operating modes, and therefore needs no further aids or functional checks, but can also be seen in the fact that production tests can be rationalized, since the device can automatically carry out the test of the display means. A visual and therefore fault-susceptible test of the display in production control can consequently be dispensed with.
In a refinement of the invention, the display comprises a number of optical elements, preferably light-emitting diodes, corresponding to the number of selectable operating modes. Each optical element is preferably assigned a feedback element, preferably an optical conductor, the feedback element guiding the light emitted by the optical element to a light evaluation unit, which checks the state of the optical element.
These measures permit the construction of a fail-safe display with little effort and low costs. The light emitted by the optical element is guided via an optical conductor to an optical sensor, which generates a corresponding signal. This signal is then compared with the reference signal, in order to be able to make a statement as to whether the optical element is operating without faults. The use of light-emitting diodes as optical elements has proven to be particularly beneficial. Furthermore, the use of optical elements on each input and output module (decentralized display means) permits an expensive central display to be dispensed with. In systems which have a relatively large number of modules, however, this advantage decreases again. Of course, it might also be considered to test the optical element for freedom from faults in a different way. One possible way is to impress two different currents on the optical element, preferably an LED, one after the other and to measure the two different voltages. Via a comparator, it is then possible to establish whether the two voltages lie above or below a predefined threshold value. If there are deviations from a predefined result here, there must be a fault.
In another refinement of the invention, the display is implemented as a central display, preferably as a liquid crystal display device. The operating modes of the input module and/or of the output module are preferably displayed in two different types and/or in two mutually independently driven areas of the display, so that a fail-safe representation is achieved.
These measures permit the use of a display, i.e. a monitor, in order to set the operating modes of the input modules and output modules, without safety being lost. As a result of the two different types of representation, the user can specifically detect whether the display is faulty. Apart from the above-mentioned measure, other routes to a solution of making the display fail-safe might also be considered. Furthermore, as compared with the decentralized optical elements, a flat display offers much more convenience when setting the operating modes. In particular, graphic symbols can be used, which very much more clearly impart to the user the set operating modes and the overall structure of the system.
In an alternative refinement of the invention, for a self-monitored display, a self-luminous display can be fit above an image sensor and in this way the image output can be compared with the image actually displayed.
In another refinement of the invention, the input module is implemented with two channels and comprises semiconductor outputs. The control module preferably comprises a logic linking unit, which links output signals from the input modules with one another, preferably AND links them, and feeds them to an output module on the basis of the set operating mode. The output signal from the input module can preferably be fed to each output module, this assignment of input module to output module being carried out via the setting of the operating mode.
Of course, it is also possible for the individual input signals to be read into the control module and evaluated there, linked and fed to the outputs.
These measures have the advantage that a very flexibly configurable safety switching device system can be built up. In particular, the output signals from the individual input modules can be fed to individual or several of the output modules as desired. Different configurations are therefore possible, which could previously only be achieved by changing the wiring.
In a further refinement of the invention, the control module comprises a memory unit, preferably as an EEPROM, in which the selected operating modes of the input module and of the output module can be stored in a manner safe against zero voltage. The current states of the input module and of the output module are stored in a further memory unit, preferably a RAM.
This measure has the advantage that the operating modes and operating states are stored centrally, so that, for example, a check on the state of the entire system can be carried out simply by reading out from these central memories. Consequently, communication with the individual modules for diagnostic purposes is not necessary.
In a further refinement of the invention, the control module is assigned a configuration switch, preferably a key switch, for changing over into a programming mode. The control module preferably comprises an input unit for the input of the operating modes, the input unit in the simplest case comprising at least two cursor keys and a confirmation key.
The use of a key switch has the advantage that an inadvertent changeover into the programming mode, and therefore possibly a change of individual operating modes, is not possible. For the purpose of programming, the system has to be switched over deliberately into the programming mode by rotating the key switch.
The construction of an input unit having at least two cursor keys and a confirmation key permits, firstly, the deliberate addressing and setting of a module and, secondly, permits space-saving accommodation in the safety switching device system with very low costs.
The input into the input unit is not safety-oriented. Erroneous inputs are recognized by means of the fail-safe display by the person carrying out the configuration. It is therefore possible to carry out the input into the input unit in other ways known. For example, an input via an input tool on a computer and an infrared interface (IrDA) into the input unit, with input monitoring via the fail-safe display, can be implemented. The operating mode is configured in the safety device and is displayed.
Further advantages and configurations of the invention emerge from the description and the appended drawing.
It goes without saying that the features mentioned above and those still to be explained below can be used not only in the combination respectively specified but also in other combinations or on their own without departing from the scope of the present invention.